Guides Fake tech support & remote access (AnyDesk)
Step-by-step guide · individuals
AnyDesk or another remote access tool installed after fake support: what to check
Note the name of the tool used and the approximate time of the session. End the remote access, keep the information available, then check the accounts, the software installed and the transactions carried out during the session.
We will never ask for your codes or your passwords.
The first steps, now
If the remote session has just happened (or is still going on), start here. The rest can wait a few minutes.
Your immediate reflexes
- End the remote session: close the software, disconnect from the internet if the remote access is still active, then restart the device.
- Don’t pay anything more and don’t call back the number shown in the fake alert.
- From a safe device (another phone or computer), change the passwords of the accounts opened during the call: email, bank, Microsoft, Google, Apple, PayPal, tax, insurance.
- Call your bank if a payment, a transfer, a card or a mobile wallet was used.
- Keep the evidence: software used, invoice, screenshot of the alert, number called, times, payments, emails received.
Never hand over a code received by text, a password, a recovery phrase, a full card number or a screenshot showing your login details, even to someone who claims to want to “help you” or “secure your account”.
Act fast, but in the right order
Getting back to safety follows a logic. Otherwise you risk changing passwords from a machine that is still accessible, or erasing evidence before you have understood what happened.
What a fake technician may have done
Remote access does not automatically mean all your data has been copied. But some points must be checked, especially if the session lasted a long time or if sensitive accounts were opened.
Persistent remote access
The software may remain installed, start with Windows or macOS, or allow a reconnection if unattended access was turned on.
Exposed login details
The fraudster may have watched you type passwords, looked through the browser, exported bookmarks or pushed you to sign in to sensitive accounts.
Payment or subscription
You may have paid for a fake service, given your card details, approved a payment or signed up to a subscription presented as “protection”.
The most common remote access software to look out for: AnyDesk, TeamViewer, RemotePC, Supremo, RustDesk, Zoho Assist, LogMeIn, Splashtop, Chrome Remote Desktop, VNC, ScreenConnect.
On the computer, then on the accounts
Cleaning up is not just deleting the icon from the desktop. And accounts should always be checked from a clean device, never from the machine that is still suspect.
The checks to carry out
Check the programs installed, startup items, extensions, downloads and traces of remote connections.
- Recently installed apps, especially remote control tools
- Startup programs, services, scheduled tasks and unknown profiles
- Chrome, Edge, Firefox or Safari extensions installed during the incident
- Recent downloads, executables, archives, fake antivirus software or “cleaners”
- History, saved passwords, saved cards and open sessions
- Windows Defender / antivirus, firewall, system updates and disk encryption
The accounts to check
Focus on the accounts opened or visible during the call, and close active sessions.
- Main email account (and hidden forwarding rules)
- Bank account and mobile payment
- Microsoft, Google or Apple account
- PayPal, Amazon, mobile operator
- Password manager
Before cleaning up, keep this evidence
The temptation is to delete everything immediately. But some traces are useful to understand what happened, prepare a police report or produce a report.
- The initial alert: a photo or screenshot of the blocking screen, the number shown and the message supposedly from Microsoft, Apple or an antivirus.
- The remote software: name of the software, session ID, screenshots of the app, time of installation and length of the call.
- The payment: invoice, receipt, email, card transaction, transfer, IBAN or trading name of the so-called support.
- The accounts opened: a list of the accounts viewed during the call and of the passwords typed or visible on screen.
- The aftermath: sign-in alerts, security emails, bank block, police report or receipt.
The most common traps
Three mistakes that often come up after fake support, easy to avoid once you know them.
Thinking you’re in the clear too soon
An antivirus is useful, but on its own it doesn’t check compromised accounts, email rules, payments, browser extensions or the evidence needed for a file.
Checking from the suspect machine
Changing your passwords or checking your accounts from the computer that may still be controlled can expose everything again. Use a clean device.
Rushing to wipe the computer
Wiping can be appropriate in some cases, but it can also destroy useful traces. It’s better to assess the risk, the accounts opened and whether there is persistent access first.
What we are often asked
Should I wipe the computer?
Not automatically. Wiping can be appropriate in some cases, but it can also destroy useful traces. It’s better to assess the level of risk, the accounts opened, the tools installed and whether there may be persistent access.
Is it serious if I only shared my screen?
Screen sharing can be enough to expose sensitive information: emails, codes, bank history, documents, visible login details or notifications. The risk depends on what was displayed and how long the session lasted.
I paid the fake support: what should I do?
Contact your bank immediately, block your card if necessary, dispute the transaction and keep the invoice, the receipt, the trading name, the website used and the exchanges.
Is an antivirus enough after the incident?
No. An antivirus is useful, but on its own it doesn’t check compromised accounts, email rules, payments, browser extensions or the evidence needed for a file.
You don’t have to handle everything alone
Some signs justify supported intervention, a single point of contact who secures and documents things with you:
- A long remote session, or unattended access turned on on the device
- A bank payment made or a card number handed over
- An email, bank or tax account opened during the call
- Need for a usable report for the bank, the insurer or a police report
Commitments, not promises: we check, secure, document and advise, without guaranteeing any result (no refund, no recovery of funds, no identification of the culprit), and without ever asking for your codes. Your data stays in France.
Further reading
These public resources confirm the right reflexes after a fake alert or remote access.
More guides & situations
Depending on what happened during the call, these pages complete your return to safety.
Preserving evidence
What to capture and keep before cleaning up, so you don’t weaken your case with the bank, the insurer or the police.
Open the guide →Fake bank adviser
A payment was approved during the call? Hang up, block your card, dispute, and build a solid file.
Open the guide →Hacked email account
An email account was opened during the session? Take back control, remove forwarding rules and unknown sessions.
Open the guide →Is it happening right now?
Three steps right away: end the remote session, don’t delete anything (evidence is fragile), and if a payment is involved, call your bank. Then let us guide you, with no commitment.
Not sure? Start with the free diagnosis.
In a few minutes, you’ll know what to check and in what order to act, and then you decide whether you want an expert’s help.